Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Timed challenge-response and memory-occupation challenges

No new hardware needed

Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Timed challenge-response and memory-occupation challenges, GPU contention probes: Analysis

Family findings

• Timed challenge-response and memory-occupation challenges

  Context for GPU contention probes. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • Timing-based software attestation has been broken in practice in Timed challenge-response and memory-occupation challenges

    Castelluccia et al. implemented two generic attacks, one based on a return-oriented rootkit and one on code compression, together with specific attacks on SWATT and ICE-based schemes, on commodity sensor nodes. They conclude that secure time-based attestation is "very difficult, if not impossible, to design correctly". The attacks target embedded schemes, not AI accelerators. ^{2 3}

    Response: Perrig and van Doorn, two of the designers of SWATT and ICE, replied in August 2010. They argue that the rootkit attack defeats a naive implementation, not a property the schemes claim, and that the SWATT attack was run on a re-implementation on a chip with eight times the program memory, where SWATT's own chip is almost always full of code. They accept that the attack on ICE works.

    Demonstrated attack · Significant · Disputed. On the record

  • Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

    Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ⁴

    Theoretical argument · Significant · Open. On the record

    Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

  • Error rates not quantified in Timed challenge-response and memory-occupation challenges

    Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ¹

    Open question · Minor · Open. On the record

Open significant flaws

2 flaws in 1 mechanism

• Error rates not quantified in GPU contention probes

  Monfared et al. show timing distributions that shift under contention, but leave hardware-specific thresholds to future work and state that false-positive and false-negative rates are not quantified. ¹

  Open question · Significant · Open. On the record

• Answers are not tied to one GPU in GPU contention probes

  The paper's floating-point fingerprint characterises a GPU model. The authors state that it does not distinguish individual GPUs, so a probe answer does not show which device of that model produced it. ¹

  Theoretical argument · Significant · Open. On the record

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

The records connect no other mechanism to this proposal's gaps, open flaws or dependencies.

Blockers

2 blockers recorded

• Timed challenge-response and memory-occupation challenges
  • Continuous probes add power draw, occupy GPU memory and reduce inference throughput. Performance & compatibility ¹
  • No thresholds or statistical tests define when a timing shift counts as a detection. Adversarial validation ¹

From the family or selected implementation's record. ?

Model weights

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Inputs and outputs

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Training data

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original
2. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
3. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original
4. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original